smol-toml 1.7.0 DoS: Malformed TOML Documents Crash Parser

smol-toml 1.7.0 DoS: Malformed TOML Documents Crash Parser

Summary

A denial-of-service vulnerability in smol-toml 1.7.0 allows attackers to crash the parser by supplying malformed TOML documents. Applications that parse untrusted TOML input—such as user-provided configuration files or API payloads—are vulnerable to service disruption. The vulnerability is fixed in smol-toml 1.7.1.

Affected Versions

The Vulnerability Explained

The smol-toml parser, commonly used in Node.js applications to parse TOML configuration files and data formats, contains insufficient input validation when processing malformed TOML documents. When the parser encounters certain types of malformed syntax—such as incomplete key-value pairs, unclosed brackets, or invalid escape sequences—it fails to recover gracefully. Instead of returning a parse error, the parser may crash or enter an infinite loop, causing the entire application to hang or terminate.

This vulnerability becomes critical in scenarios where applications accept TOML input from external sources:

• Configuration management tools that accept config files from users or CI/CD pipelines
• API servers that parse TOML payloads in request bodies
• Document converters that process TOML files uploaded by users
• Package managers or build tools that read dependency manifests in TOML format

An attacker with the ability to supply a malformed TOML document can trigger a denial of service with minimal effort—no special privileges, no code execution, just a crafted text file.

Attack Scenario

Consider a web service that allows users to upload TOML configuration profiles:

const toml = require('smol-toml');

app.post('/upload-config', (req, res) => {
  const configFile = req.body.config; // User-supplied TOML string
  const parsed = toml.parse(configFile); // Vulnerable call
  // Process the configuration...
});

An attacker submits a specially malformed TOML document, such as:

[section
key = "value"
[[array
item = 1

The parser in version 1.7.0 crashes when it encounters the unclosed brackets and invalid syntax, causing the entire service to become unresponsive. No error is caught; the application terminates or hangs indefinitely.

The Fix

The fix in smol-toml 1.7.1 improves the parser's robustness by:

1. Enhanced input validation: The parser now checks for syntactic completeness before processing tokens.
2. Better error recovery: Malformed structures are now caught and reported as parse errors rather than causing crashes.
3. Bounds checking: The parser validates array and table boundaries more strictly.

The upgrade from 1.7.0 to 1.7.1 is reflected in the dependency manifest:

- "smol-toml": "^1.3.1",
+ "smol-toml": "^1.7.1",

This single-line change in package.json pulls in the patched version that handles malformed TOML gracefully. The parser now returns a clear error message for invalid syntax instead of crashing the application.

Real-World Impact

Before the fix: A user uploads a typo-ridden TOML config file. The application crashes immediately, affecting all users until the process restarts. Attackers can weaponize this into a denial-of-service attack by automating malformed uploads.

After the fix: The same malformed file is rejected with a descriptive parse error. The application logs the error, continues running, and can respond with a helpful message to the user.

How Orbis AppSec Detected This

Source: User-supplied TOML input passed to the parse() method via HTTP requests, file uploads, or configuration APIs.

Sink: The smol-toml.parse() function, which processes the TOML string without sufficient pre-validation.

Missing control: The parser lacked comprehensive error handling for incomplete or syntactically invalid TOML structures, allowing malformed input to trigger unhandled exceptions or infinite loops instead of returning a parse error.

CWE: N/A (unknown)

Fix: Upgrade smol-toml from 1.7.0 to 1.7.1, which hardens the parser's input validation and error recovery logic.

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Key Takeaways

• Always validate TOML input at the application boundary: Even if a parser claims to handle errors, test your code with malformed input to ensure it fails safely.
• Treat parser crashes as security issues: A parser that crashes on unexpected input is a denial-of-service vulnerability waiting to be exploited.
• Keep parser dependencies up to date: Parsing libraries are frequently updated to fix robustness issues. smol-toml 1.7.1 specifically hardens against the attack patterns that crashed 1.7.0.
• Monitor for parse errors in production: Log and alert on parse failures; they may indicate an active denial-of-service attempt.
• Test with fuzzing tools: Use tools like AFL or libFuzzer on your TOML parser with malformed inputs to find crashes before attackers do.

Conclusion

CVE-2026-85730 demonstrates why robust error handling in parsers is a security concern, not just a quality-of-life feature. Upgrading smol-toml to 1.7.1 eliminates the denial-of-service risk for any application parsing untrusted TOML input. The fix is a simple dependency update with no breaking changes—deploy it immediately if you use smol-toml in production.